0

I am a self-taught wordpress website designer so pardon my possible ignorance.

A few sites I had worked on for a client were recently defaced by an Indonesian hacker group (fun!). The client had not been updating their wordpress install and a few other things which compromised security.

There are no clean back-ups of the websites unfortunately.

The web host gave me a text file with the result of the malware scan. It looks like a lot of the files that were affected are the nav-menu.php files of the sites.

An example of a result of the scan showing in the text file would be: "[home directory]/[website folder name]/wp-includes/nav-menu.php: SL-PHP-INJECTOR-1-ejw.UNOFFICIAL FOUND"

I understand that deleting the affected files can solve issue and get the account back and running since it was disabled by the host until the issue is mitigated, but I guess deleting this file would break something. Is there something like a standard, clean nav-menu.php file that I can replace these with? And if so, where can I obtain it?

Thanks.

  • Just download a fresh copy of WordPress, it’s in there. – Jacob Peattie Nov 2 '17 at 5:33
  • And just as an suggestion after cleaning the files I would change all user passwords and install some security plugin like iThemes Security or All In One WP Security. – jimihenrik Nov 2 '17 at 7:57
0

To answer your question, you can find the original file in the WordPress Github repository.

However, when a WordPress website is hacked and has malware infected files it is recommended to reinstall the entire site with a clean install (without plugins), check the database for infected entries and change all (WordPress, database, etc) passwords.

When you have reinstalled the website you should check all plugins used if they have known security issues before enabling them again. Plugins are the most common cause of security flaws, and should preferably be kept up to date.

You can make it easier for yourself (and your client) by configuring automatic background updates in your wp-config.php file.

I'd also advise reading some guides on WordPress security.

  • Thanks for your detailed reply. So does that mean I would delete the entire contents of the website folder and then reinstall? – user779961 Nov 2 '17 at 6:41
  • If you don't have a backup of when the website wasn't infected then a complete reinstall would be the best. I'd advise you to make a backup of the website and database as it is now (infected and all) and do a clean install from wordpress.org/download. To check if the database is infected you can dump the database as text and search in it (search for strings like eval(base64_decode). – Jesse Vlasveld Nov 2 '17 at 6:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.